IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Potential Abuse of Resources by High Token Count and Large Response Sizes Appendix Z: Downloadable rule update v8.13.7 »
Elastic Docs ›Elastic Security Solution [8.13] ›Downloadable rule update v8.13.6

AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User

edit

AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User

edit

Identifies multiple successive failed attempts to use denied model resources within AWS Bedrock. This could indicated attempts to bypass limitations of other approved models, or to force an impact on the environment by incurring exhorbitant costs.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 10m

Searches indices from: now-60m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: LLM
  • Data Source: AWS Bedrock
  • Data Source: AWS S3
  • Resources: Investigation Guide
  • Use Case: Policy Violation
  • Mitre Atlas: T0015
  • Mitre Atlas: T0034

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Setup

edit

Setup

This rule requires that guardrails are configured in AWS Bedrock. For more information, see the AWS Bedrock documentation:

https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html

Rule query

edit
from logs-aws_bedrock.invocation-*
| where gen_ai.response.error_code == "AccessDeniedException"
| stats total_denials = count(*) by user.id, gen_ai.request.model.id, cloud.account.id
| where total_denials > 3
| sort total_denials desc
« Potential Abuse of Resources by High Token Count and Large Response Sizes Appendix Z: Downloadable rule update v8.13.7 »